SCIM schema explorerUser - corrected (default)Runs in your browser - nothing leaves this page.

schemavariant

{
  "id": "urn:ietf:params:scim:schemas:core:2.0:User",
  "name": "User",
  "description": "User Account",
  "source": "RFC 7643 Section 8.7 with the verified errata applied (2025-10-28 batch)"
}

attribute

type

multiValued

required

mutability

returned

uniqueness

caseExact

userName

string

false

true

false

readWrite

default

server

name

6 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
formatted	string	false	readWrite	default	false
familyName	string	false	readWrite	default	false
givenName	string	false	readWrite	default	false
middleName	string	false	readWrite	default	false
honorificPrefix	string	false	readWrite	default	false
honorificSuffix	string	false	readWrite	default	false

complex

false

false default

readWrite

default

none default

displayName

string

false

readWrite

default

none

nickName

string

false

readWrite

default

none

profileUrl

reference

false

readWrite

default

none

title

string

false

readWrite

default

none

userType

string

false

readWrite

default

none

preferredLanguage

string

false

readWrite

default

none

locale

string

false

readWrite

default

none

timezone

string

false

readWrite

default

none

active

boolean

false

false default

readWrite

default

none default

password

string

false

writeOnly

never

none

emails

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: work, home, other)	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

phoneNumbers

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: work, home, mobile, fax, pager, other)	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

ims

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: aim, gtalk, icq, xmpp, msn, skype, qq, yahoo)	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

photos

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	reference	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: photo, thumbnail)	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

addresses

7 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
formatted	string	false	readWrite	default	false
streetAddress	string	false	readWrite	default	false
locality	string	false	readWrite	default	false
region	string	false	readWrite	default	false
postalCode	string	false	readWrite	default	false
country	string	false	readWrite	default	false
type	string (canonical: work, home, other)	false	readWrite	default	false

complex

true

false

false default

readWrite

default

none default

groups

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readOnly	default	false
$ref	reference	false	readOnly	default	false
display	string	false	readOnly	default	false
type	string (canonical: direct, indirect)	false	readOnly	default	false

complex

true

false

false default

readOnly

default

none default

entitlements

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

roles

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	string	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: )	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

false default

readWrite

default

none default

x509Certificates

4 sub-attributes

sub-attribute	type	required	mutability	returned	caseExact
value	binary	false	readWrite	default	false
display	string	false	readWrite	default	false
type	string (canonical: )	false	readWrite	default	false
primary	boolean	false	readWrite	default	false default

complex

true

false

readWrite

default

none default

The dashed "default" chips mark characteristics this schema JSON omits; Section 2.2 assigns their defaults (required false, caseExact false, mutability readWrite, returned default, uniqueness none, type string), and Section 2.4 assigns the default sub-attribute set for multi-valued attributes (type, primary, display, value, $ref). The corrected variant is the default view: ten verified errata alter the published Section 8.7 JSON, and the 2025-10-28 verified batch is the state future revisions build on.

The sample resources built from these schemas (RFC 7643 Sections 8.2-8.4) are the targets the PATCH builder applies PATCH bodies against, op by op.

Verified RFC 7643 errata (16)

RFC 7643 · SECTION 8.7 SCHEMAS

The schema explorer

Read the RFC 7643 Section 8.7 schemas attribute by attribute, with the Section 2.2 characteristic defaults and the as-published versus corrected variants side by side.

Runs in your browser - nothing leaves this page.RFC 7643 Section 8.7, corrected default

The playground renders each Section 8.7 schema attribute by attribute, annotates every characteristic a schema JSON omits with its Section 2.2 default, and lets the as-published text be compared against the corrected variant that applies the ten verified errata. This page is a complement to conformance tools, not another validator: conformance suites probe a live provider, while this playground reads the schema contract itself, which is what attribute-level integration decisions are made from.

The history

Why a corrected default needs a toggle

The schema JSON in RFC 7643 Section 8.7 shipped with defects. Sixteen errata are verified against the RFC as of the 2025-10-28 verification batch, and ten of them alter the Section 8.7 JSON itself: the Group schema declared displayName REQUIRED in prose while carrying"required": false (erratum 5368); complex attributes carried a uniquenesscharacteristic the model does not define for complex types (6004); the reference types ofgroups.$ref listed User where only Group applies (8471). A reader transcribing the published JSON inherits each defect; a reader trusting the prose inherits the contradictions.

The playground defaults to the corrected variant and keeps the as-published text one toggle away, because both readings matter: the corrected text is what implementations should converge on, and the published text is what older libraries copied. The errata panel lists all sixteen with their own dates, and the JSON-altering entries that touch the currently viewed schema highlight the rows they select.

The discovery path

Read the schema before writing the client

The three discovery endpoints answer, in order: what features, which resources, and which attributes. The IANA registry at iana.org/assignments/scim carries the schema URIs the newer RFCs extend.

The mechanics

Characteristics, defaults, and discovery

Characteristics (Section 2.2). Every attribute carries type, multiValued, required, caseExact, mutability, returned, and uniqueness. "If not otherwise stated in Section 7", the defaults apply: not required, not case-exact, readWrite, returned by default, no uniqueness, type string. The dashed "default" chips in the playground mark exactly these inherited values, because an omitted characteristic is a claim too, and integrations are won or lost on it: caseExact decides whether manager.value matches byte-for-byte, and mutability decides which PATCH operations a provider must reject.

Multi-valued defaults (Section 2.4). A multi-valued attribute's unspecified sub-attribute set is the standard five: type, primary, display,value, and $ref. The Section 8.7 schemas declare theirs explicitly; custom extensions inherit the five.

Discovery (RFC 7644 Section 4). /ServiceProviderConfig states what the provider supports, including filter.maxResults and whether PATCH exists at all./ResourceTypes names each resource, its endpoint, and its schema plus extension URIs./Schemas resolves those URIs into attribute definitions. Providers SHOULD support filtering on the read-only endpoints. The published Section 8.7 JSON is the same shape/Schemas returns, which is why its errata matter twice over: once for the book, once for the wire.

The registry. SCIM's schema URIs are an IANA registry (iana.org/assignments/scim, established by RFC 7643 Section 10). RFCs 9865, 9944, and 9967 extend it; a client that discovers URIs instead of hard-coding them inherits those additions without a rewrite.

Attacks and defenses

What each defense is for

Failure	Defense	Where it is defined
Attributes hard-coded from one provider's quirks failing on the next	Discover /ResourceTypes and /Schemas; write against the returned schema, not a memory of it	RFC 7644 Section 4
Case-sensitive comparisons against case-insensitive attributes (or the reverse)	Read `caseExact` per attribute; Section 3.10 makes path facets case-insensitive even when values are not	RFC 7643 Section 2.2, RFC 7644 Section 3.10
Writes to attributes the schema marks readOnly or immutable being rejected in production	Check `mutability` before the write; the PATCH builder applies the same matrix	RFC 7643 Section 2.2 (mutability), RFC 7644 Section 3.5
Transcribing the published Section 8.7 JSON with its recorded defects	Use the corrected variant as the default reading; the as-published toggle documents exactly what changed and under which erratum	RFC 7643 errata (verified 2025-10-28 batch)
Custom extension URIs colliding or drifting from the registry	Register and resolve URIs through the IANA SCIM registry; enterprise and vendor extensions live beside the core ones	RFC 7643 Section 10, iana.org/assignments/scim

References

RFC 7643: SCIM: Core Schemathe normative core schema (IETF, September 2015); Section 2.2 characteristics and defaults, Section 2.4 multi-valued defaults, Section 8.7 the schema JSON, Section 10 the IANA registry
RFC 7644: SCIM: ProtocolSection 4 defines the discovery endpoints and their filtering; Section 3.10 the case-insensitive attribute notation
RFC Editor errata for RFC 7643sixteen verified errata as of the 2025-10-28 batch, ten altering the Section 8.7 JSON; the playground's per-erratum dates and deltas come from these pages, retrieved 2026-11-01
IANA: SCIM Schema URIs registrythe registry spine the newer RFCs (9865, 9944, 9967) extend